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Chapter 1 
Creating the Example Template Systems 


Creating a flat (linear) model bootloadable system for an Intel386™ 
family microprocessor is straightforward. BLD386, the system 
builder, assigns absolute addresses and makes the necessary system 
data structures. Several working examples are included on your 
diskette. You can build the example systems and monitor their 
execution on an in-circuit emulator without prior knowledge of the 
Intel386 architecture, and without knowing how the systems work; 
just follow the the step-by-step directions in Section 1.2. 


Chapter 2 contains discussions of the templates and the flat memory 
models they represent. Certain Intel-specific terms used here may be 
unfamiliar to you, such as 32-bit protected mode, descriptor, segment, 
or gate. If you come across unfamiliar terms, or if you are interested 
in learning more about the Intel386 architecture, see the Glossary at 
the end of this booklet or the /ntroduction to the 80386 or the 80386 
Programmer’s Reference Manual listed at the end of this chapter. 


The Example Software 


The software files are templates because they are patterns you can 
build upon and modify in creating your own bootloadable system. 
There is code for three different C applications and an assembler 

application, each of which can be built into a bootloadable system. 
Three different kinds of systems can be built: 


e asimple RAM system that runs without any interrupt handlers 


e atypical embedded system with code in ROM and data and tables 
in RAM 


e asystem protected from stack overflow 


| 
| 


The templates include all of the source code, some sample 
applications, the commands necessary to build the sample systems, and 
commands for an ICE-386™ or ICE-376™ in-circuit emulator to 
demonstrate the sample systems. The tables that follow group the 
files by the type of example system they build. 


FILES FOR SIMPLE EXAMPLE 


simpinit.asm microprocessor initialization code 


estart.asm startup code for C application 


simple C-386 application 


simple.c 


BLD386 system definitions 


simple.bld 


simple.bat nie commands for assembling, compiling, 
simple.com (VMS binding, and building 
showsimp.inc simple system emulator commands 


FILES FOR EMBEDDED EXAMPLE WITH INTERRUPT STUBS 


flatinit.asm microprocessor initialization code 


flatintr.asm 


interrupt stubs 


cstart.asm startup code for C application 


bitcount.c C-386 application 


C-386 application 


reverse.c 


flat.bld 


BLD386 system definitions 


flat.bat ne commands for assembling, compiling, 
flat.com (VMS binding, and building 
showbitc.inc bitcount system emulator commands 


reverse system emulator commands 


showrevr.inc 
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FILES FOR PROTECTED EXAMPLE 


3 


protinit.asm microprocessor initialization code 


protintr.asm interrupt procedure for asmstart 


asmstart.asm startup code for ASM386 application 


protect.asm ASM386 application 
protect .bld BLD386 system definitions 


protect.bat tee commands for assembling, binding, 
protect.com (VMS and building 


showprot.inc protect system emulator commands © 


(*) 1.2 Executing the Examples 


You can execute the examples by following these simple directions. 


1) Please ensure that your development system has the following 
software and hardware: 


REQUIRED HARDWARE AND SOFTWARE 


| Name | Version | Description 


asm386 V3.8 Macro Assembler 
c386 V1.8 C-386 C Compiler 


bnd386 | RLLv1.3 | Binder (V1.3) 


a b1d386 | RLLv1.3 | System Builder (V1.4) 


Ns jce386 ICE-386 or ICE-376 In-Circuit 
ice376 Emulator on DOS host 


2) Copy all the template files to your working directory. For VMS, 
the template files are located in the directory 
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3) 


4) 


5) 


6) 


SYS&ROOT: [SYSHLP.EASE]. For DOS, the files are located on the 
diskette entitled Program Development Templates. All files are 
ASCII text. 


To create an example system, invoke the appropriate file of rel 
commands. 
DOS simple system: simple 

embedded system: flat bitcount or 

flat reverse 

protected system: protect 
VMS simple system: @simple 

embedded system: @flat bitcount or 


@flat reverse 
protected flat system: @protect 


These commands assemble, compile (if necessary), bind, and build 
the system. The assembler and builder issue valid warning 
messages designed to guide careful creation of the systems. You 
can ignore these messages. 


For VMS, download your system (simple, bitcount, reverse, #) 
or protect) and corresponding file of emulator commands 
(showsimp.inc, showbitc.inc, showrevr.inc, or 

showprot.inc) to your DOS in-circuit emulator host. 


On your DOS in-circuit emulator host, change to your ICE-386 
or ICE-376 in-circuit emulator software directory. Copy the 
system (simple, bitcount, reverse, or protect) from your 
working directory to your in-circuit emulator software directory. 
Then copy the corresponding file of emulator commands 
(showsimp.inc, showbitc.inc, showrevr.inc, or 
showprot.inc) from your working directory to your in-circuit 
emulator software directory. 


Press the reset button on the in-circuit emulator. Invoke the in- 
circuit emulator. 


ice386 or oO ' 


jice376 
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7) 


8) 


9) 


At the -> prompt, include the sequence of commands written for 
you by typing in one of the following followed by a carriage 
return. 


->include nolist showsimp.inc /* for showing simple */ 
->include nolist showbitc.ine /* for showing bitcount */ 
->include nolist showrevr.inc /* for showing reverse */ 
->include nolist showprot.ince /* for showing protect */ 


To start the commands, at the -> prompt type the name of the 
system you have created followed by a carriage return. 


->simple /* to view simple */ 
->bitcount /* to view bitcount */ 
->reverse /* to view reverse */ 
->protect /* to view protect */ 


Follow the execution of your system, entering a carriage return 
when prompted. 


The ICE-386 in-circuit emulator issues error #-26t on the istep 
command. Though the message is valid, you can ignore it 
because the emulator chip is executing in real mode and no 
selectors are accessible. 


The sequence of emulator commands ends when the emulator 
returns you to the -> prompt. You can view another sample 
system that you have created by returning to step 7 of these 
directions, or you can exit the emulator. To exit the emulator, 
type exit. 


->exit 
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Related Publications 


The following publications contain further information on the Intel386 
family of microprocessors. 


Intel386™ Family System Builder User's Guide, order number 481342 @ 
Intel386™ Family Utilities User’s Guide, order number 481343 

Introduction to the 80386, order number 231252 

80386 Programmer’s Reference Manual, order number 230985 

80386 System Software Writer’s Guide, order number 231499 

ASM386 Assembly Language Reference Manual, order number 480251 


ASM386 Macro Assembler Operating Instructions for DOS Systems, 
order number 451290 


ASM386 Macro Assembler Operating Instructions for VAX/VMS 
Systems, order number 167675 


C-386 User’s Guide, order number 481378 

ICE™-376 In-Circuit Emulator User’s Guide, order number 481753 
ICE™-386 In-Circuit Emulator User’s Guide, order number 481404 
ICE™-386/25 In-Circuit Emulator User’s Guide, order number 481749 
ICE™-386SX™ In-Circuit Emulator User’s Guide, order number 451989 


Trademarks 


Intel386, 376, 386, 386SX, and ICE are trademarks of Intel 
Corporation. 


VAX and VMS are trademarks of Digital Equipment Corporation. 
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Chapter 2 
Exploring the Templates 


You can use the templates in many different systems. They are easy 
to understand and are at the heart of most embedded, 32-bit 
protected-mode systems. 


Section 2.1 describes the flat model for 32-bit protected-mode 
programming. It explores the flat control for the system builder and 
the build file of system definitions. Section 2.2 describes the 
templates for the embedded examples with interrupt stubs. Most of 
this information applies to the other example systems as well. Section 
2.3 describes adding protection to the flat model. Section 2.4 
describes the protected example templates, including implementing a 
protected expand-down stack. 


Protected-Mode Programming 


Your code must initialize the Intel386™ family microprocessor to run 
in 32-bit protected mode after system reset. Each example system has 
code to initialize the microprocessor to run in protected mode. The 
key that simplifies the initialization is using the system builder, 
BLD386, which creates the absolute 32-bit protected-mode system 
from your code. 


The builder builds an absolute 32-bit protected-mode system from the 
linked input segments you provide. You also provide a build file that 
defines system implementation details. This build file may contain 
information such as protection levels, system data structure 
definitions, and memory configuration. Each example system has a 
template build file. 


The Intel386 family of microprocessors enables you to program in 
32-bit protected mode using a flat memory model. The flat model is 
easy to use because all address space is linear. The flat model is good 
for systems that require large amounts of memory for data or code. 


2.1.1 


The Default Flat Memory Model 


The feature of the system builder that makes the flat memory model 
easy to use is the flat control. Using the flat control, you can 


implement many details of a flat model system automatically. When 
flat is used, the builder: 


Creates two segments called _phantom_code_and _Phantom_ data_. 
The default descriptor privilege level (DPL) value is zero, or most 
privileged. These overlaid segments each have a default base 
address of zero and a default limit of 4 gigabytes - 1. Figure 2-1 
depicts the default flat memory model used by the builder. 


Combines input segments into the appropriate phantom segment 
in the order of input. Even though the segments are overlaid, the 
builder does not overlap true code and data. When ROM areas 
and RAM areas are specified in the build file, the builder 
allocates space for segments according to their access attributes: 
ROM receives read-only segments (tables and task state segments) 


and executable segments (code), RAM receives read-write 
segments (data and stack). 


_Phantom_code_ 


code segment 
7] ffff fffft 


Two overlaid segments, 
Memory 


both based at @ in physical memory, 
and both having a limit of 4 gigabytes - 1 


go08 gaoon C 


data segment 
_phantom data_ 


Figure 2-1 Default Flat Memory Model 
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e Adjusts gates and all relative and absolute jumps to use the base 
of the _phantom_code_ descriptor. 


e Adjusts all data and stack accesses to use the base of the 
_phantom_data_ descriptor. 


The Embedded Example Templates 


The embedded example templates demonstrate the code necessary for 
a typical embedded application with interrupt stub routines. The 
initialization, startup, and interrupt code is written in ASM386 
assembly language. The sample application is written in C-386. 
Figure 2-2 illustrates the structure of the files that contain the source 
code. Note that the compilation of the C application produces a data 
segment and a code32 segment. The binder combines segments with 
like names. See Figure 2-3 in Section 2.2.6 to see how the modules 
become a bootloadable system. 


bitcount.c or 


flatinit.asm flatintr.asm cstart.asm reverse.c 


flatstart interrupts cstart main 


{- 323. 
init code intrupt stack . data 
segment routings segment + segment 
segment 


Lo 


data | P| 
code32 segment - code32.. 
segment - segment . 


code32 z : 
segment . a 
| 


Figure 2-2 Embedded Example Source Code 


The Initialization Template 


The initialization code template, flatinit.asm, contains two distinct 
parts. The first part, the init_code segment, places the 
microprocessor into 32-bit protected mode. Since the code runs on 
both the 386™ microprocessor (which, at reset, is in 16-bit real mode) 
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and the 376™ microprocessor (which, at reset, is in 32-bit mode), the 
init_code segment is a 32-bit segment. For correct execution on a 


386 microprocessor, operand prefixes before some instructions change 
the default operand size. 


The other part of the initialization code, copytables in the code32 
segment, copies the necessary parts of the descriptor tables created by 
the builder from ROM to RAM. In this example, ROM is in high 
memory and RAM is in low memory. The RAM address of the 
descriptor tables are calculated by ANDing the corresponding ROM 
address with OOOOffffH. The code copies 5 global descriptor table 
(GDT) entries and the first 17 interrupt descriptor table (IDT) entries 


down into RAM. This example has only 16 interrupt routines, for 
interrupts 0 through 14 and 16. 


NOTE FOR ROM-BASED SYSTEMS 


If you are implementing a ROM-based system like this 

example, then the process of copying the descriptor tables to 

RAM may be important. The microprocessor attempts to write 6 A 
to the GDT descriptor’s ACCESS bit upon execution of an 

lgdt or 1gdtw instruction (load the global descriptor table 

register, GDTR). The GDT is initially in ROM. Unless the 

GDTR is loaded with a RAM-based address, your hardware 

must return a READY upon a write to ROM. 


If your hardware does indeed return a READY after a write 
to ROM, then the step of copying descriptor tables down to 
RAM in the copytables routine is unnecessary. Ensure that 
your initialization code also loads the interrupt descriptor table 
register (IDTR) and simply replace the far jump destination at 
the end of the code32 segment with that of your startup code 
(c_startup in the example). 


After the code copies the necessary parts of each table from ROM to 


RAM, the code adjusts the base and limit values in the GDT and IDT 
alias descriptors in the global descriptor table. @ 


A listing of the flatinit.asm file follows. 
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Se we we we we we we we we we we ws we we we we we ws we we we we we UE we we we 


flatinit.asm 
Initialization code for flat (linear) model example 


HRA EERE IEKIII IIIT IAI IIIA I IAAI IAAI IAAI KIA AIHA IIIA A 


Version 2.8 

Copyright Intel Corp., 1988 

This template is intended for your benefit in developing applications/ 
systems using Intel386(TM) family microprocessors. Intel hereby grants 
you permission to modify and incorporate it as needed. 


HAKKAR IIIA III IIIA AAI AAA IAI IAAI IAAI AAAI AADAAA AAA AAI 


This is initialization code to put the 386(TM) processor or 376(TM) | 
processor into flat mode. It should work with all applications, ! 
but this model makes certain assumptions. The memory model is a typical 

embedded application model: descriptor tables and code reside 

in ROM and data is in RAM. This example assumes that ROM begins at 

OffffOOBGH; since descriptor tables may need to be RAM-based for 

protected-mode execution, the code copies the builder-created GDT and IDT 

down into RAM with the RAM address being <ROM address AND QO@OffffH>. It 

assumes five GDT entries: NULL, a GDT alias, an IDT alias, code, and data. 

The builder creates the GDT alias and IDT alias and places them, 

by default, in GDT[1] and GDT[2]. After entering protected mode, 

this code jumps to an ASM386 startup routine for a C application. You 

can change this JMP address to that of your code, or make the label of 

your code C_STARTUP. 


NAME flatstart 3 name of object module 


EXTRN c_startup:near 


pe flag equ 1 
gaTias off equ 8 
jalias off equ 18H 


gdt Tim equ 27H 


this is the label jumped to after init_code 
and copytables 


for setting PE bit 
offset of GOT alias in GDT 
offset of IDT alias in GODT 


assume that 5 entries are all that are needed in GDT 


, 
> 
data selc equ 20H =; offset of phantom data_ in GDT (GDT[4]) 
’ 
H 


idt_lim equ 87H 


assume that 17 entries are all that are needed in IDT 


CODEMACRO opprefx 5 macro to change default operand size 
ENDM 


db 66H 


init_code SEGMENT ER PUBLIC 


GDT_DESC and IDT DESC are public symbols referred to in the build file. 
The LOCATION definitions in the TABLE section of the build file point to 
these labels; the builder stores the base and limit for the named table 
at this location in memory. 


PUBLIC gdt_desc 
PUBLIC idt_desc 
gdt_desc dp ? 
idt_dese dp ? 
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; START is a label that points to the true beginning of our executable 
3; code. The BOOTSTRAP control causes the builder to place a short jump to 
3 the named label (in this case, START) at the component reset vector. 


PUBLIC start @> 


Since this code initializes either a 386 or 376 processor into protected 
mode, the first instructions at START test for component type. 

The 386 processor at reset is in real or compatibility mode: the PE bit is 
off and the D bit for CS is not set. Instructions execute in their 16-bit 
form. The 376 processor at reset has the PE bit on as well as the D bit, 

so instructions execute in their 32-bit form. 


nop s NOPs are for initializing a 386 
nop 3 processor 
start: 
eld 


3 clear direction flag 
smsw bx 3 check for processor (376 or 386) at reset 


test bl,1 use SMSW rather than MOV for speed 
jnz pestart 


3 Loading the GDTR at REALSTART or PESTART depends on user hardware 
s; returning a READY after a write to ROM. 


and eax, 8ffffh 


make address relative to reset area 
lgdtw cs: [eax] 


load 24 bits of base into GDTR 


realstart: 3 is a 386 processor and in 16-bit real mode 
opprefx 3 use operand prefix to 
mov eax,offset gdt_desc ; get 32-bit address of GDT pointer 6 \ 
opprefx 3 use operand prefix to 
» 


mov ax,bx 3 copy machine status word 

or al,pe flag s; set PE bit 

lmsw ax 3; load machine status word 

jmp next ; flush prefetch queue 
pestart: 


is a 376 processor in 32-bit protected mode 
get 32-bit address of GDT pointer 

make address relative to reset area 

load 32 bits of base into GDTR 


mov eax,offset gdt_desc 
and eax, Offffh 
lgdt cs:[eax] 


next: 


xor eax,eax s initialize data selectors 
mov al, data _selc GDT[4] is _phantom_data_ 
mov ds,ax 


Mov $sS,aXx 

mov es,ax 

mov fs,ax 

Mov gs,ax J 
test bl,1 : 
jnz pejump 
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Use C_STARTUP as the destination of this next jump if your hardware does 
return a READY on a write to ROM, and skip the COPYTABLES routine. 


opprefx $ use operand prefix for 386 processor jump 
pejump: 
jmp far ptr copytables s first far jump causes A31-A2@ to drop low 


init_code ENDS 


copytables: 


Copy GDT and IDT from ROM to RAM. Assume the RAM address for the tables is 
the ROM address AND O@08ffffH. This code uses the second GDT entry, 
the GDT alias at GDT[1] = (base of GDT) + galias_off. 


mov eax,offset gdt desc 3 get address of gat desc 
mov ebx,dword ptr [eax]+2 ; base of GDT is 2 bytes past gdt_desc 


Move the GDT descriptors from ROM to RAM. 


source of move is present GODT base 
calculate address of new GDT 

destination of move is calculated address 
count of move is 5 entries X 8 bytes each 
move 5 descriptors from ROM to RAM 


mov esi,ebx 

and ebx, OffffH 
mov edi,ebx 

mov ecx,gdt_lim+l 
rep movsb 


Modify the GDT alias at GDT[1] to reflect the new base and limit of 

the RAM-based GDT. The GDT alias is a data segment descriptor 

(read/write) which allows future modification of the GDT. 

Reload the GDTR with the new base and limit values. We do this by | 
changing the GDT alias to reflect the new base and limit, saving the 

changes, setting up the GDT alias to reload the GDTR, reloading, and then 

restoring the GDT alias. EBX holds the new base address of the GDT. 


3 change base in second dword of GOT alias 
and dword ptr [ebx]+galias of f+4,Offff20H 

‘ change limit in GDT alias 
mov word ptr [ebx]+galias_off,gdt_lim 

3 save part of GDT alias 
mov edx,dword ptr [ebx]+galias off+2 

3 set up new base for loading GDTR 
mov dword ptr [ebx]+galias_off+2,ebx 

: reload the GDTR 
lgdt pword ptr [ebx]+galias_off 

3 restore saved part of GDT alias 
mov dword ptr [ebx]+galias_off+2,edx 


s IDT mov from ROM to RAM 


get address of idt desc 
base of IDT is 2 bytes past idt_desc 


mov eax,offset idt desc 
mov edx,dword ptr [eax]+2 
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Move the IDT descriptors from ROM to RAM. 


mov esi,edx 

and edx,OffffH 
mov edi,edx 

mov ecx,idt_limtl 
rep movsb 


source of move is present IDT base 
calculate address of new IDT 

destination of move is calculated address 
count of move is 17 entries X 8 bytes each 
move 17 descriptors from ROM to RAM 


Modify the IDT alias descriptor at GDT[2] to reflect the new base and limit 
values for the RAM-based IDT and load the IDTR. EBX holds the address of 
the new GODT. EDX holds the address of the new IDT. 


change base in second dword of IDT alias 
and dword ptr [ebx]+ialias | offta, Of fffOGH 


: change limit in IOT alias 
mov word ptr [ebx]+ialias off,idt_lim 


3 save part of IDT alias 
mov ecx,dword ptr [ebx]tialias_off+2 


3 Set up new base for loading IDTR 
mov dword ptr [ebx]+ialias_ off+2, edx 


A load the IDTR 
lidt pword ptr [ebx]tialias | off 


3 restore saved part of IDT alias 
mov dword ptr [ebx]+ialias_off+2,ecx 


jmp c_startup 3 jump to startup code 


code32 ENDS 


END 
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The flat.bld build file containing system definitions is both simple 
and generically useful. The following briefly explains the use of each 


definition. 

SEGMENT sets the descriptor privilege levels (DPLs) of all 

definition input segments to zero, or most privileged. The 
builder creates the overlaid phantom_code_ and 

_phantom_data_ segments when the flat control is 

used; they are included here as a reminder, even 
though their default descriptor privilege level is 
zero. 

TABLE (first occurrence) defines the global descriptor table 

definition (named GDT). 
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TABLE 
definition’s 
LOCATION 
specification 


TABLE 
definition’s 
BASE 
specification 


TASK 
definition 


GATE 
definition 


TABLE 
definition 


MEMORY 
definition 
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places the absolute base address and limit 
(describing the GDT) into memory defined in the 
initialization code. The symbol gdt_desc is an 
uninitialized 6-byte area in the initialization 
module. The LOCATION feature is handy when you 
are relocating code often: since BLD386 always 
places the correct base and limit values in memory, 
you can change the location of either your 
initialization module (containing gdt_desc) or of 
your GDT and re-build without re-assembling any 
code. 


absolutely locates the GDT at the specified address 
in memory. In this example the GDT goes in 
ROM. Knowing the exact base address of this 
table is useful when debugging. 


defines a task for the system. If the system data 

structures representing a task are in the 

bootloadable system, then the in-circuit emulator 

initializes the processor and makes ready to execute 

the task. A flat model system does not require a | 
task, however. The demonstration emulator | 
commands reset the emulator to execute the \ 
initialization code. 


creates gate descriptors. The 386 and 376 
microprocessors require that interrupt descriptor 
table entries be interrupt, task or trap gates. 
Instead of creating gate descriptors in assembly 
language, BLD386 creates them with the GATE 
definition. The ENTRY specification for each gate 
specifies the public label of the interrupt handlers. 


(second occurrence) defines the interrupt descriptor 
table (named IDT), sets the location to store the 
base and limit of the table to be idt_desc in 
init_code, and places the interrupt gates in the 
table. 


describes the physical memory setup of the 
hardware, and defines the location of the software 
system. 


MEMORY 
definition’s 


specifies holes in the address space, or defines 
address ranges used in other ways (such as 


RESERVE destinations of copied descriptor tables). BLD386 
specification cannot place any code or data in this area of S 
memory. ¢ 
MEMORY determines which address ranges are RAM or 
definition’s ROM. When ROM and RAM areas are specified in 
RANGE the build file, the builder allocates space for 
specification segments according to their access attributes: , ROM 
receives read-only segments (tables and task state 
segments) and executable segments (code); RAM 
receives read-write segments (data and stack). 
TABLE (last occurrence) tells the builder that the default 
definition local descriptor table (which we named LDT1) it 
creates should not be put in the bootloadable 
system. The contents of the table does appear in 
the builder listing, however. 
A listing of the flat.bld build file follows. 6 
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-- flat.bld 
-- Build file for input to BLD386 to create flat model example 


HAA IIIA IIIT AAAI KKK IK 
@ -- Version 2.6 
Q -- Copyright Intel Corp., 1988 

-- This template is intended for your benefit in developing applications/ 


-- systems using Inte1386(TM) family microprocessors. Intel hereby 
-- grants you permission to modify and incorporate it as needed. 


HIKARI IIIA EIA IIRIEIIIIIAREERRERIRRREEREIHREKKIEIAIAIAIK 


flat; -- build program id 


SEGMENT 
*segments DPL 
_Phantom_code_ (DPL 
_Phantom_data_ (DPL 


Give all user segments a DPL of 9. 

These two segments are created by 

8); -- the builder when the FLAT control is used. 
-- Their default DPL is 9; they are 
-- listed here for reference only. 


uu 
Qg 
—S 
. 
te 
te 


TABLE 
-- create GDT 
GDT -- GDT_ DESC is a public symbol in 
-- the "flatstart" initialization module. 
© (LOCATION = gdt desc, -- In the buffer starting at GDT DESC, | 
SS 7 -- BLD386 places the GDT base and H 
-- GDT limit values. Buffer must be 
-- 6 bytes long. The base and limit 
-- values are places in this buffer 
-- as two bytes of limit plus 
-- four bytes of base in the format 
-- required for use by LGDT instruction. 
BASE = Off ff@108H 
);  -- end GDT 
TASK -- Task is for ICE(TM)-386 or 
main_task -- ICE(TM)-376 emulator initialization. 
(BASE = OffffO2G0H, 
DATA = data, -- Points to a segment that 
-- indicates initial DS value. 
CODE = main, -- Entry point is main, which 
-- must be a public id. 
STACKS = (stack), -- Segment id points to stack 
-- segment. Sets the initial SS:ESP. 
INTENABLED -- Disable interrupts. 
» 
™ 
NU” «GATE 
int@_gate (INTERRUPT, DPL = 8, ENTRY = int@), 
intl gate (INTERRUPT, DPL = 8, ENTRY = intl), 
int2_gate (INTERRUPT, DPL = @, ENTRY = int2), 
int3_ gate INTERRUPT, DPL = 8, ENTRY = int3), 
int4_gate INTERRUPT, DPL = @, ENTRY = int4), 
int5 gate INTERRUPT, DPL = @, ENTRY = int5), 
int6 gate INTERRUPT, DPL = 8, ENTRY = int6), 
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int7_gate (INTERRUPT, DPL = 8, ENTRY = int7), 
int8_ gate (INTERRUPT, DPL = 8, ENTRY = int8), 
int9 gate (INTERRUPT, DPL = 8, ENTRY = int9), 
int18 gate (INTERRUPT, DPL = 9, ENTRY = Heh 
intll_gate (INTERRUPT, DPL = 8, ENTRY = intll), 
intl2_gate (INTERRUPT, DPL = 8, ENTRY = intl12), 
intl3_gate (INTERRUPT, DPL = 8, ENTRY = intl3), 
intl4_gate (INTERRUPT, DPL = 8, ENTRY = intl4), 
jntl6 gate (INTERRUPT, DPL = 9, ENTRY = int16); 
TABLE 
-- create IDT 
I0T 


IDT_DESC is a public symbol in the 
"flatstart" initialization module. 

In the buffer starting at IDT_DESC 

the builder places two bytes of the IDT 
limit and four bytes of the IDT base 
values in the format required for use 
by LIDT instruction. 


(LOCATION = idt_desc, 


BASE = OffffO200H, 


Slots @ through 31 are Intel-reserved 


ENTRY = (@:int@ gate, l:intl_gate, 2:int2_gate, 3:int3_gate, 

4:int4_gate, 5S:intS gate, 6:int6 gate, 7:int7 gate, 
B:int8 gate, 9:int9 gate, 1@:int1B gate, 11:int1I_gate, 
12:int1Z_gate, 13:int13 gate, 14:intl4_gate, 16:int16_gate) 

)s  -- end I0T S 

MEMORY 


(RESERVE = (0..258H), 


-- For copying down IDT and GDT. 
RANGE = ( 


-- begin configuration section -- 
rom_area = ROM(OffffOOGH. .OFffffffOH) , 
ram_area = RAM(251H. .OffffH) 

-- end configuration section 


ABLE 
ldt1 (NOT CREATED); -- Builder does not place LDT in object 


-- module, but contents appear in listing. 


END 

2.2.3 The Interrupt Stubs Template 
A listing of the interrupt stubs in the file flatintr.asm follows. Intel 
reserves the first 32 interrupts. Those which have been defined have 
a stub. 
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ee 


flatintr.asm 
Interrupt fault handlers for use with flat model example 


HIKARI EIR RIEKEKEKEEREKREREKEAKEKIIK 


Version 2.8 

Copyright Intel Corp., 1988 

This template is intended for your benefit in developing applications/ 
systems using Intel386(1TM) family microprocessors. Intel hereby 

3 grants you permission to modify and incorporate it as needed. 


~ 


HIKE III IK AAA AERA KIKI TAI IIIA IIHR EIR AREER EERIE 


NAME interrupts 
intrupt_routines SEGMENT ER PUBLIC 


PUBLIC int@, intl, int2,int3, int4, int5, int6, int7, int8, int9, intl, intll 
PUBLIC int12,int13,int14, int1l6 


; If an exception occurs, the corresponding fault handler is 
3 entered. The interrupt number is pushed on top of the stack. 


int® : push @@H s divide error 
jmp entrez 
intl : push 61H ; debug exceptions 
jmp entrez 
© int2 : push 82H 3 non-maskable interrupt 
\S jmp entrez 
int3 : push 93H s breakpoint 
jmp entrez 
int4 : push O4H 3 overflow 
jmp entrez 
intS : push @5H 3 bounds check 
jmp entrez 
int6 : push @6H s invalid opcode 
jmp entrez 
int7 : push 87H $ coprocessor not available 
jmp entrez 
int8 : push 88H 3; double fault 
jmp entrez 
int9 : push @9H 3 coprocessor segment overrun 
jmp entrez 
intl@ : push @aH 3 invalid tss 
jmp entrez 
intll : mov ax,ds 5; segment not present 
mov ds,ax $ ensure full loading of the segment registers 
mov ax,es 
mov es,ax 
push @bH 
jmp entrez 
intl2 : mov ax,ds 3 stack exception 
mov ds,ax s ensure full loading of the segment registers 
Mov ax,es 
mov es,ax 
push OcH 
jmp entrez 
intl3 : push @dH 3 general protection 
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jmp entrez 


intl4 : push @eH 3 page fault 
jmp entrez 
intl6 : push 18H $ coprocessor error 


entrez : hit q 


intrupt_routines ENDS 


END 


2.2.4 The C Startup Template 


The code in cstart.asm defines a stack for a C application. The 
stack pointer is initialized, and the C routine is called. A listing of 
the cstart.asm file follows. 


estart.asm 
An ASM386 module to initialize the stack and call a C application 


WHERE IRR IRII HII RII IIIREIIAIAARRARRIEAIKAERRRRARAAAA AA I I 


Version 2.9 

Copyright Intel Corp., 1988 

This template is intended for your benefit in developing applications/ 
systems using Intel386(TM) family microprocessors. Intel hereby 

grants you permission to modify and incorporate it as needed. 


8 ee we we we we we we we we we we we 


kkkkkkkkeKkhkkekkkkkKK kkk hk oz hbk 


NAME estart 
EXTRN main:near 
PUBLIC c_startup 


3 name of the object module 
3 label of the C application to be called 
3 public symbol used in processor initialization code 


stack STACKSEG 1824 


data SEGMENT RW PUBLIC 
data ENDS 


code32 SEGMENT ER PUBLIC 


c startup: 

~ mov esp,stackstart stack 
call main call C application 
hit halt processor 


code32 ENDS 6 


END 


initialize stack pointer 
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2.2.5 


Creating the Embedded Example System 


Your template software includes a file of commands for assembling, 
compiling, binding, and building your 32-bit protected-mode system. 


The three invocations of ASM386 create object modules 
flatinit.obj, flatintr.obj and cstart.obj. The assembler issues 
warnings with each invocation due to the use of privileged 
instructions in the files. The debug control directs ASM386 to include 
extra information useful in symbolic debugging. The listing files are 
flatinit.Ist, flatintr.Ist, and cstart. Ist. 


VMS: DOS: 
asm386/debug flatinit.asm asm386 flatinit.asm debug 
asm386/debug flatintr.asm asm386 flatintr.asm debug 
asm386/debug cstart.asm asm386 cstart.asm debug 


The invocation of C-386 creates an object module parameter .obj, 
where the parameter is replaced with the name of the application 
code file without its extension. The regallocate control directs the 
compiler to optimize the allocation of register variables. The code 
control causes placement of a pseudo-assembly language listing at the 
end of the listing file. Debug directs C-386 to include extra 
information useful in symbolic debugging. The listing file is 
parameter .\st. 


VMS : DOS: 
¢386/debug/regallocate/code 'pl.c 386 %1.¢c debug regallocate code 


BND386 combines the input segments and resolves symbolic 
addressing. The noload control directs the binder to create a linkable 
(rather than loadable) file. The debug control indicates that the 
binder does not purge debug information. Object directs the output 
file to be named porameter.bnd. The listing file is parameter .mp1. 


VMS: 
bnd386/noload/debug/object='pl.bnd 'pl.obj, flat.obj, cstart.obj 


DOS: 
bnd386 %l.obj, flat.obj, cstart.obj noload debug object (%1.bnd) 


The goal is an absolute bootloadable file (all addresses fixed in 
memory) suitable for loading into an ICE™-386 or ICE™-376 in-circuit 
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emulator. BLD386 creates such an absolute module, necessary 


descriptor tables, and a task for initializing the emulator. The 

buildfile control identifies flat.bld as the build file. The 

bootstrap control identifies the symbol start as the label of the \ 
instruction to be jumped to by the bootstrap jump placed at ¢ 
OfffffffOH. The flat control directs the builder to configure the file 

in a flat model, where all code resides in the _phantom_code_ segment 

and all data resides in the phantom _data_ segment. The mod376 

control causes the builder to issue messages to guide creation of the 

object module for a 376 processor. The warning about overlapping 

memory is such a guide. You can remove this control to create an 


object module for a 386 processor. The listing file is parameter .mp2. 
The final system is parameter. 


VMS: 
b1d386/buildfile=flat.bld/bootstrap=start/flat/mod376 'pl.bnd, intrpt.obj 


DOS: 
b1d386 %1.bnd,intrpt.obj buildfile (flat.bld) bootstrap (start) flat mod376 


¢ 
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2.2.6 


The Embedded Example System 


Figure 2-3 shows what the memory looks like with the location of 


ffff ffffH 


reset 
vector--ffff fffGH 


ffff 8278H 
ffff O2GGH 


ffff 6178H 


KN 


ffff S190H 


ffff OOOOH 


8281 SBBBH 
2008 ffffH 


9688 9251H 
8208 SBGBH 


ROM 


interrupt routines 
intrupt_routines 
copytables & application 
iad code3e 


task state segment 
main tas 


initialization code 
init_code 


ae ee ee 
global descr. table 


ae eee eee 
interrupt descr. table 


stack and data 
stack 
data 


reserved 


code, data, and system data structures after building the system with a 
small C application. 


limit 


_phantom_code_ 
and 
_Phantom_data_ 


base 


Figure 2-3 Embedded Example System Memory Map 


a 
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The maps portion of the builder listing file, bitcount.mp2, for the 
bitcount example system follows. 


88386 SYSTEM BUILDER 


12/14/88 15:12:29 PAGE 


SEGMENT MAP 


3 


TABLE PBIT DPL ACCESS USE BASE 


GDT 
1 1 @ RW 
2 1 6 RW 
3 1 6 £0 
4 1 @ RW 
LOT.1 (LDT1) 
1 1 @ RW 
2 1 @ ER 
3 1 @  RWD 
4 1 6 ER 
5 1 8 RWD 
6 1 68 ER 


88386 SYSTEM BUILDER 


32 
32 


12/14/88 15:12:29 PAGE 


GATE TABLE 
GATE NAME TABLE 


INT1 GATE IDT(1 
INT27GATE DT (2 
INT3GATE — IDT(3 
INT4GATE DT (4 
INTS-GATE —IDT(5 
INT6-GATE —1DT(6 
INT7“GATE —IDT(7 
INTS"GATE —1DT(8 
INT9-GATE DT (9) 
INTIB GATE 1DT(18 
INTI17GATE IDT(11 
INT12“GATE IDT(12 
INT13-GATE  IDT(13 
INT14-GATE 10T(14 
INTI6-GATE IDT(16 
INT@ GATE —10T(8) 


2-18 


FFFF@10H 
FFFFQQ88H 
2BBBB2GBH 
BBBBB200H 


FFFF®138H 
FFFF@278H 
@8281268H 
FFFF@178H 
88002268H 
FFFFQ368H 


4 


LIMIT 


90080037H 
BOBQG0FFH 
FFFFFFFFH 
FFFFFFFFH 


80080037H 
@0BQGEDH 
FFFFEFFFH 
BBBGQB5EH 
FFFFEFFFH 
90000051H 


PBIT DPL TYPE WC 


ee 
Saga anaagnaggaaean 


386INTR 
386INTR 
386INTR 
386INTR 
3861INTR 
386INTR 
386INTR 
3861NTR 
386INTR 
386INTR 
386INTR 
3861NTR 
386INTR 
386INTR 
386INTR 
3861NTR 


QRagaaaaaaeeoeanns 


SEGMENT NAME 


GDT: 
IDT: 
_PHANTOM_CODE_ 
“PHANTOM_DATA_ 


LOT1: 

BITCOUNT .CODE32 
BITCOUNT.DATA 

BITCOUNT. INIT CODE 
BITCOUNT.STACK 

INTERRUPTS. INTRUPT_ROUTINES 


SELECTOR OFFSET 

GDT (3 FFFF@364H 
GOT(3 FFFF®368H 
apres FFFFO36CH 
GDT (3 FFFF@378H 
GDT(3 FFFFQ374H 
GOT (3 FFFF@378H 
GOT 3} FFFF@37CH 
GOT (3 FFFFQ389H 
eoria FFFFQ384H 
GDT (3 FFFFQ388H 
GOT (3 FFFFQ38CH 
GOT (3 FFFFQ398H 
GDT (3 FFFFQ3A4H 
GOT (3 FFFFO3A8H 
GDT (3 FFFFO3ACH 
GDT (3 FFFF@368H 
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88386 SYSTEM BUILDER 
12/14/88 15:12:29 PAGE 5 


9 TASK TABLE 

(Cd 

We MAIN_TASK: TABLE = GDT(6) PBIT = 1 DPL = 9 
BASE = FFFF@28GH 


LIMIT 90000067 
SS@:ESPO= GDT (4) :60002260H 
SS1:ESP1= -------- 
SS2:ESP2= -------- 

SS:ESP = GDT(4) :@@@02268H 
PDR eas 

CS:EIP = GDT(3) :FFFF@2BQH 
DS = GDT(4) 

LOT en 

IOPRIV = Q@H 


INTERRUPT NOT ENABLED 
DEBUG NOT ENABLED 
INITIAL 


PROCESSING COMPLETED. 1 WARNING, @ ERRORS 


“ 
uf, 
TW 

Soo 
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2.3 


limit ffff ffffH [ 


base 


_Phantom_code_ 


The Protected Flat Memory Model 


You can easily create a system which combines the advantages of the 
flat memory model with the added value that the segmentation 
hardware can trap invalid data, code, and stack references. This 
variant of the flat memory model is called protected flat. 


Remember that both the phantom_code_and phantom _data_ 
segments must have the same base address. The default base address 
for these segments is 0. Use the SEGMENT definition in the build file 
to specify a different base address evenly divisible by 64K bytes. 


The phantom segments do not have to span the entire address space, 
nor do they have to have the same limit. The default limit for these 
segments is 4 gigabytes - 1. Use the SEGMENT definition in the build 
file to specify different limits for one or both of the phantom 

segments. The minimum definition of a protected flat model system 


is one that has at least one of the phantom segments with a limit of 
less than 4 gigabytes - 1. 


Figure 2-4 shows an example of a minimally protected flat memory 
model with phantom data _'s limit less than 4 gigabytes - 1. 
Reference to data outside of _phantom data_ causes a general 
protection fault. 


code segment 


-——NO DATA REFERENCES HERE 


limit (less than ffff ffffH) 


_phantom data_ 


ge08 go08H [ 9088 G200H base 


data segment 


Figure 2-4 Minimally Protected Flat Memory Model 
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In the default flat model, the builder puts the stack with the data in 

_phantom_data_. Code and data are not protected from stack 
overflow. In the protected flat model, you can define a separate 
expand-down stack outside of _phantom data_, adding the value of 
protecting the rest of the system from stack overflow. The 
expand-down stack has the same base address as the phantom 
segments. The builder sets its size to at least 4K bytes. 


Use the build file SEGMENT definition to define the stack as ED 
(expand-down), and to define a limit less than 4 gigabytes - 1 but 
greater than O bytes. Do not specify a base address for the stack. 
Install the stack segment’s descriptor in the GDT with the TABLE 
definition. 


Figure 2-5 shows an example of a protected flat memory model with 
a separate expand-down stack. Although the phantom segments’ 
limits are shown to be the same, they could be different as long as 
neither overlapped the expand-down stack. (Remember, memory 
wraps from high to low addresses on the Intel386 processors.) 


j— limit (phantom segments) 


_phantom_code_ 


and 


phantom data 
Memory - = oad 


— base (all segments) 
expand-down 
stack 


— lowest available address 
for expand-down stack 


Figure 2-5 Protected Flat Memory Model with Expand-down Stack 
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2.4 The Protected Example Templates 


The protected example templates differ from the embedded example 
templates in several ways. The phantom segments are not based at 
physical zero. The protected example demonstrates the creation of a 
separate expand-down stack. The application is written in assembly 
language. An interrupt procedure handles a dummy interrupt. Figure 
2-6 illustrates the structure of the files that contain the source code 
for the protected example. See Figure 2-7 in Section 2.4.6 to see how 
the modules become a protected flat bootloadable system. 


protinit.asm protintr.asm asmstart.asm protect.asm 


protstart asmstart applic_func 


init code intproc systack appstack 
segment segment stack stack 
segment segment 


code32 
segment 


syscode applic code 
segment segmenrit 


Figure 2-6 Protected Example Source Code 


2.4.1 The Initialization Template 


The initialization code template, protinit.asm, performs the same 
functions for the protected system as the initialization code for the 
embedded system. The first part, the init_code segment, places the 
microprocessor into 32-bit protected mode. The second part, 
copytables in the code32 segment, copies the necessary parts of the 
descriptor tables created by the builder from ROM to RAM. 


The major differences in code arise from the non-zero base of the 
phantom segments. The RAM addresses of the descriptor tables are 
still calculated by ANDing the corresponding ROM address with 
OOOOffffH. The gdt_desc and idt desc still hold the absolute base 
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Oe We we we we we we we we we we we we we ws we we We ws we we we ws we we we we we we we we we we Be we 


and limit values for the two tables. To copy a table and adjust its 
alias descriptor in the GDT, the code calculates the relative base for 
the table, which is the offset of the new table from the non-zero 
phantom base. (Remember, memory wraps from high to low 
addresses on the Intel386 processors.) 


For simplicity, the code holds the values of the non-zero phantom 

base and the relative offset of absolute zero from this base. If the 
base of the phantom segments changes, the code must also change. 

(The code can be independent if it accesses the non-zero phantom 

base in one of the phantom segments’ descriptors and calculates the 
relative offset of absolute zero instead.) 


A listing of the protinit.asm file follows. Highlights point out the 
major added or changed code dealing with the non-zero base of the 
phantom segments. 


protinit.asm 
Initialization code for protected flat (linear) model example 


RIKI KEIRKIIR IIHR IKI IDI IIIA IIIA IBIAS IH IAI HII AAAI A IAIN. 


Version 2.9 

Copyright Intel Corp., 1988 

This template is intended for your benefit in developing applications/ 
systems using Intel386(TM) family microprocessors. Intel hereby grants 
you permission to modify and incorporate it as needed. 


HRI IKI III IKARIA IRI IARI IIIA III IIIA IIIA AAA IAAI AAI IAAI IASI IAA IAAI AK. 


This is initialization code to put the 386(TM) processor or the 376(TM) 
processor into protected flat mode. It should work with all applications, 
but this model makes certain assumptions. The memory model is a typical 
embedded application model: descriptor tables and code reside jin ROM 
and data is in RAM. This example assumes that ROM begins at OffffOO0RH; 
since descriptor tables may need to be RAM-based for protected-mode 
execution, the code copies the builder-created GDT and IDT down into RAM 
with the RAM address being <ROM address AND OffffH> relative to the base 
of phantom code and phantom data . It assumes six GDT entries: NULL, 
a GDT alias; an TOT alTas, code, data, and a separate stack. After 
entering protected mode, this code jumps to an ASM386 startup routine. 
You can change this JMP address to that of your code, or make the label 
of your code SYSTART. 


WIKI III III II III II III II III III III IIE TTI IIE IIIA IAA AAAI AAA AAAI AAA IAA IAIN 
Note: Changing the base of the phantom segments in the build file 
requires a similar change for the variables PHANTOM BASE and 


PHANTOM ZERO. The base of the phantom segments must be evenly 
divisible by 64K bytes. 


FRI IH IKI IIHT KIKI IK IH III IAI IAI III IAI IAAI AI AIA IAI ASAI AAAI A SI AAI AA AAS IN. 
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NAME protstart name of object module 


EXTRN systart: far this is the label jumped to after init_code 


and copytables 


pe flag equ 1 
gaTias off equ 8 
lalias off equ 18H 
data selc equ 28H 


for setting PE bit 

offset of GDT alias in GDT 

offset of IDT alias in GDT 

offset of phantom data_ in GDT (GOT[4]) 

gdt_Tim equ 2fH assume that 6 entries are all that are needed in GDT 

idt_lim equ 18fH assume that 34 entries are all that are needed in IDT 
phantom zero equ 18888H 3 offset of absolute 8 from base of phantom segs 

phantom base equ OffffG808H ; base of phantom segments 


CODEMACRO opprefx 3 macro to change default operand size 
db 66H 
ENDM 


init_code SEGMENT ER PUBLIC 


GDT_DESC and IDT DESC are public symbols referred to in the build file. 
The LOCATION definitions in the TABLE section of the build file point to 


these labels; the builder stores the base and limit for the named table 
at this location in memory. 


PUBLIC gdt_desc 
PUBLIC idt_desc 
gdt_desc dp 2 
idt_desc dp ? 


s START is a label that points to the true beginning of our executable 
3 code. The BOOTSTRAP control causes the builder to place a short jump 
s to the named label (in this case, START) at the component reset vector. 


PUBLIC start 


Since this code initializes either a 386 or 376 processor into protected 
mode, the first instructions at START test for component type. 

The 386 processor at reset is in real or compatibility mode: the PE bit is 
off and the D bit for CS is not set. Instructions execute in their 16-bit 
form. The 376 processor at reset has the PE bit on as well as the D bit, 
so instructions execute in their 32-bit form. 


we we we we we we 


nop s NOPs are for initializing a 386 
nop $ processor 

start: 
cld clear direction flag 


smsw bx ; check for processor (376 or 386) at reset 
test bl,1 ; use SMSW rather than MOV for speed 
jnz pestart 


; Loading the GDTR at REALSTART or PESTART depends on user hardware 
s returning a READY after a write to ROM. 


realstart: 3 is a 386 processor and in 16-bit real mode 
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opprefx 

mov eax,offset gdt desc 
opprefx ~ 

and eax,8ffffh 

lgdtw cs: [eax] 


use operand prefix to 

get 32-bit address of GDT pointer 
use operand prefix to 

make address relative to reset area 
load 24 bits of base into GDTR 


mov ax,bx 3 copy machine status word 
or al,pe_ flag 3 set PE bit 
Imsw ax 3 load machine status word with PE bit set 
jmp next s flush prefetch queue 
pestart: is a 376 processor and in 32-bit protected mode 


mov eax,offset gdt desc 
and eax, Offffh rm 
Igdt cs: [eax] 


xor eax,eax 

mov al,data selc 
mov ds,ax 
Mov ss,ax 

mov es,ax 

mov fs,ax 

mov gs,ax 

test bl,1 

jnz pejump 


get 32-bit address of GDT pointer 
make address relative to reset area 
load 32 bits of base into GDTR 


initialize data selectors 
GDT[4] is _phantom_data_ 


Use SYSTART as the destination of this next jump if your hardware does 
return a READY on a write to 


opprefx 


pejump: 


jmp far ptr copytables 


init_code ENDS 


copytables: 


Copy GODT and IDT from ROM to RAM. 
is the absolute ROM address AND O@00ffffH. 


ROM, and skip the COPYTABLES routine. 
use operand prefix for 386 processor jump 


first far jump causes A31-28 to drop low 


Assume the RAM address for the tables 
This code uses the 


second GDT entry, the GDT alias at GDT[1] = (base of GDT) + galias off. 


mov eax,offset gdt desc 


mov ebx,dword ptr [eax]+2 


. 
® 
. 
» 
. 
» 


get address of gdt_desc 
base of GDT is 2 bytes past gdt_desc 
note that ebx holds absolute base of GOT 


Move the GDT descriptors from ROM to RAM. 


mov esi,ebx 

xor esi,phantom base 
and ebx,OffffH — 

add ebx,phantom zero 
mov edi,ebx 7 

mov ecx,gdt_lim+l 


source of move is base of GDT relative to 
phantom segments 

displacement of GDT in ROM 

calculate offset of new GDT 

destination of move is calculated address 
count of move is 6 entries X 8 bytes each 
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EEE eoocc'u™or 


rep movsb s move 6 descriptors from ROM to RAM 


Modify the GDT alias at GDT[1] to reflect the new base and limit of the 
RAM-based GDT. The GDT alias is a data segment descriptor (read/write) 
which allows future modification of the GDT. Reload the GDIR with the 
new base and limit values. We do this by changing the GDT alias 

to reflect the new base and limit, saving the changes, setting up the GDT 
alias to reload the GDTR, reloading, and then restoring the GDT alias. 
EBX holds the new base address of the GDT (relative). Note that the GDT 
alias holds the absolute base of the GDT (not relative to the 

phantom segments' base). 


3 change base in second dword of GDT alias 
and dword ptr [ebx]+galias_off+4, Off ff20H 

A change limit in GOT alias 
mov word ptr [ebx]+galias off,gdt_lim 

3 save part of GDT alias 
mov edx,dword ptr [ebx]+galias of f+2 

3 get old absolute base for GDT 
mov ecx,dword ptr [eax]+2 

3 calculate new absolute base for GDT 
and ecx, OffffH 

3 set up new base for loading GDTR 
mov dword ptr [ebx]tgalias off+2,ecx 

3 reload the GDTR 
Igdt pword ptr [ebx]+galias off 

3 restore saved part of GOT alias 
mov dword ptr [ebx]+galias off+2,edx 


sce w eens see eres enenesesecsesscses Pee errs esesneseeccseoseesenessseeses 
DSDDD DDD DS DDD DDDD DDD SSSSDSSSSSSSSSSSSS DDD SD SSS DSSS SSDS SD SED SSDS ESSD 


: 1DT mov from ROM to RAM 


mov eax,offset idt desc 3 get address of idt desc 
mov edx,dword ptr [eax]+2 ; base of IDT is 2 bytes past idt desc 
3 note that edx holds absolute base of IDT 


3 Move the IDT descriptors from ROM to RAM. 


mov esi,edx s source of move is base of IDT relative to 
xor esi,phantom base 3 phantom segments 

and edx,OffffH — 3 displacement of IDT in ROM 

add edx,phantom zero s calculate offset of new IDT 

mov edi,edx ~ 3 destination of move is calculated address 
mov ecx,idt_lim+l ; count of move is 34 entries X 8 bytes each 
rep movsb 3 move 34 descriptors from ROM to RAM 


Modify the IDT alias descriptor at GDT[2] to reflect the new base and limit 
values for the RAM-based IDT and load the IDTR. AX holds the address of 
IDT DESC. EBX holds the address of the new GDT (relative). Note that the 
IDT alias holds the absolute base of the IDT (not relative to the phantom 
segments’ base). 


; change base in second dword of IDT alias 
tr [ebx]tialias_off+4, Off f fH 
and dubtd pir taba) i change limit in IDT alias 
bx]+ialias off,idt_lim 
meee pte ] 3; save part of IDT alias 


mov edx,dword ptr [ebx] tialias_off+2 
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3 get old absolute base of IDT 
mov ecx,dword ptr [eax]+2 

3 calculate new absolute base of IDT 
and ecx,OffffH 
> 3; set up base for loading IDTR 
r) mov dword ptr [ebx] tialias_ of f+2,ecx 

load the IDTR 

lidt pword ptr [ebxdtielias. off 

3 restore saved part of IDT alias 
mov dword ptr [ebx]+tialias_off+2,edx 


jmp systart 3 jump to startup code 
code32 ENDS 
END 


2.4.2 The Build File Template 


The protect.bld build file containing system definitions is where the 
work is done to define the protected flat memory model with an 
expand-down stack. The following explains the major changes. 


SEGMENT describes the segments. All of the segments get a 

definition descriptor privilege level of zero, or most 
privileged. One input segment becomes the 
separate expand-down stack. The phantom 
segments’ base is set to a non-zero value evenly 
divisible by 64K bytes, and their limits are set to 
values less than 4 gigabytes - 1. The 
_phantom_code_ segment’s limit is less than the 
_phantom « data_ segment’s limit. 


TABLE (first occurrence) defines the global descriptor table 
definition and explicitly places the expand-down stack 
descriptor in the sixth slot, GDT[5]. 


TABLE (second occurrence) defines the interrupt descriptor 
definition table and explicitly places the interrupt gate in the 
34th slot, IDT[33]. 


A listing of the protect.bld build file follows. Highlights point out 
the major changes. 
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protect.bld 
Build file for input to BLD386 to create protected flat model example 


HAKKAR REE ERERREKREREREEKREKEKEKERKKKKKKK KKK 


Version 2.8 ©) 
Copyright Intel Corp., 1988 P 


This template is intended for your benefit in developing applications/ 
systems using Intel386(TM) family microprocessors. Intel hereby 
grants you permission to modify and incorporate it as needed. 


HHH REAR REKKRKIERREREERRIKREEKEEREEKKRRIR EERE EERE EKREREKEREKKKER 


protflat; -- build program id 


SEGMENT 
asmstart -- Give all user segments a DPL of @. 
(DPL = 8), -- The name “asmstart" is the module-id 
-- for all segments because its object 
-- module is first in the BND386 input 
-- list. 
appstack -- Protected stack is expand-down. 
(ED, -- A limit for the stack must be specified 
LIMIT = 959H), -- greater than @ and less than 4 gigabytes, 
-- but the stack size is 4K bytes 
-- (or larger in 4K-byte steps). x 
-- The two phantom_ segments are created C 
-- by the builder when the FLAT control 
_phantom_ code -- is used. 
(BASE = SffffSG09H, -- Base values of both _phantom_ segments 
LIMIT = Sff89H), -- must be the same, and evenly divisible 
_phantom data -- by 64K bytes. 
(BASE = STfff8888H, 
LIMIT = 626868H) ; -- Limit values of _phantom_ segments can 
-- differ. 
TASK -- Task is for ICE(TM)-386 or 
main_task -- ICE(TM)-376 emulator initialization. 
{BASE = Offff230H, 
DATA = sysdata, -- Points to a segment that 
-- indicates initial DS value. 
CODE = systart, -- Entry point is systart, which 
-- must be a public id. 
STACKS = (systack), -- Segment id points to stack 
-- segment. Sets the initial SS:ESP. 
NO INTENABLED -- Disable interrupts. 


2-28 


TABLE -- create GOT oe 


GDT -- GDT_DESC is a public symbol in 
-- the “protstart" initialization module. 
(LOCATION = gdt_desc, -- In a buffer starting at GDT DESC, 
me -- BLD386 places the GDT base and 
-- GDT limit values. Buffer must be 
-- 6 bytes long. The base and limit 
-- values are placed in this buffer 
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BASE = OffffS20GH, 
ENTRY = (5: appstack) 


)s  -- end GDT 


as two bytes of limit plus 
four bytes of base in the format 
required for use by LGDT instruction. 


Explicitly install separate expand-down 
stack in GDT[5]. 


GATE -- Define an interrupt gate for the 
int_gate -- interrupt handler. 
(DPL = 9, 
ENTRY = intproc, 
INTERRUPT) ; 
TABLE -- create IDT 
IDT -- IDT DESC is a public symbol in the 
(LOCATION = idt_desc, -- "protstart" initialization module. 
-- In the buffer starting at IDT DESC 
-- the builder places two bytes of the 
-- IDT limit and four bytes of the IDT 
-- base values in the format required 
BASE = Offff2008H, -- for use by LIDT instruction. 
-- Slots @ through 31 are Intel-reserved. 
ENTRY = (33: int_gate) 
)3; -- end IDT 
MEMORY 
(RESERVE = (8..3@8H), -- For copying down IDT and GDT. 
RANGE = ( -- begin configuration section -- 
rom_area = ROM(OffffOOOGH. .OfffffffOH) , 
ram_area = RAM(4Q@0H. .OffffH) 
): -- end configuration section -- 
» 
TABLE 


Idt1 (NOT CREATED); 


END 


2.4.3 


Builder does not place LDT in object 
module, but contents appear in listing. 


The Interrupt Routine Template 


One interrupt procedure is defined for a non-reserved interrupt. A 
listing of the protintr.asm file follows. 
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protintr.asm 
ASM386 interrupt stub 


HIKARI KR RERRIEREKERRIEKIRIER RRR IRERERR IKKE I KIKI RIIKKEAAIITKEEEK 
Version 2.8 € } 
Copyright Intel Corp., 1988 


This template is intended for your benefit in developing applications/ 
systems using Intel386(1TM) family microprocessors. 


Intel hereby 
grants you permission to modify and incorporate it as needed. 


wows 
owe we we we we wees ee we we 


PERAK II KHIR RRR IIR IRR RRR KIRA I RII REI IRR REE III III IAI IK IIA IAAI 


NAME int_proc 

PUBLIC intproc 

intcode SEGMENT EO PUBLIC 
intproc PROC FAR 


intproc ENDP 
intcode ENDS 


END 


2.4.4 The Assembler Application Startup Template 


The code in the startup template for an assembler application defines 
a system stack, initializes the stack pointer, calls the application, and 
generates an interrupt. A listing of the asmstart.asm file follows. 
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asmstart.asm 
ASM386 system startup code for protected flat model example 


HRI II IRISH III IH HI AAA AAI AAAI IIIA AAAI IIIA AAI AAS ASA SIS ASIII AIK 


Version 2.8 

Copyright Intel Corp., 1988 

This template is intended for your benefit in developing applications/ 
systems using Intel386(TM) family microprocessors. Intel hereby 

grants you permission to modify and incorporate it as needed. 


RRIKRII RIKKI IIHR IIIA IIIA III IKI IKI II AIA IIK IARI AKAIKE IIH 


NY 


NAME asmstart 
PUBLIC systart 
EXTRN app_entry:FAR 
systack STACKSEG 198 
7 at RW 
sysdata ENDS 
syscode SEGMENT EO PUBLIC 
% ASSUME DS:sysdata, SS:systack 


systart: 
inc esi 
mov esp, stackstart systack 
call app entry 


used as marker for tracing execution 
initialize esp 
go to applic code 


inc esi marker 
int 33 cause an interrupt 
inc esi marker 


syscode ENDS 


END systart, DS:sysdata, SS:systack 


A listing of the protect.asm application follows. 
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protect.asm 
ASM386 application code to demonstrate protected flat model 


RARER RER ERK RRR ERE KEREERERREREREEEEREEEEERERERER EK IK 

Version 2.8 & 
Copyright Intel Corp., 1988 
This template is intended for your benefit in developing applications/ 


systems using Intel386(TM) family microprocessors. Intel hereby 
grants you permission to modify and incorporate it as needed. 


wes we we we we we we we we ws ee we 


WAIKIKI KIRA THT KHER IKE REE REE KKK IK IK 
NAME applic_func 
PUBLIC app_entry, error_entry, varl 


appstack STACKSEG 48 3 This is the expand-down stack 


applic data SEGMENT RW PUBLIC 
varl ~ dd? 


applic_data ENDS 
ASSUME ODS:applic_data, SS:appstack 
applic_code SEGMENT ER PUBLIC 


const dd 5 0 


app_entry: 
mov ebp,esp 
mov ax ,appstack 
mov ss ,ax 
mov esp,stackstart appstack 
mov ebx,offset const 
mov eax, [ebx] 


get selector for appstack 

set SS selector 

get initial ESP value 

get CS relative offset 

see if we get the constant from code 


push eax test stack access 

push eax test stack access 

pop varl test store 

sub esp, 4888 reduce ESP for lesser loops 


stack loop: 
push eax 
cmp eax,esp 
jne error_entry 
ine eax 
jmp stack_loop 


loop until stack limit exception 
insert your own limit comparison 


This does nothing except prove that the system works. 


; Sy 
C 
error_entry: 


mov ax, ds 3 restore SS with system stack selector 
mov ss, ax 
mov esp,ebp restore ESP 


ret go back and cause interrupt 


applic_code ENDS 
END 


2-32 Exploring the Templates 


2.4.5 Creating the Protected Flat Example System 


You create the protected example system with essentially the same 
commands as the embedded example system. The binder links the 
interrupt module with the other modules to resolve symbolic 

addressing. The commands for assembling, binding, and building 


follow. 

VMS: DOS: 
asm386/debug protinit.asm asm386 protinit.asm debug 
asm386/debug protect.asm asm386 protect.asm debug 
asm386/debug asmstart.asm asm386 asmstart.asm debug 
asm386/debug protintr.asm asm386 protintr.asm debug 

VMS: 


bnd386/noload/debug/object=protect.bnd asmstart.obj, protect.obj, 
protinit.obj, protintr.obj 


DOS: 
bnd386 asmstart.obj,protect.obj,protinit.obj,protintr.obj noload debug 
object (protect.bnd) 


VMS: 
b1d386/buildfile=protect.bld/bootstrap=start/flat/mod376 protect.bnd 


DOS: 
b1d386 protect.bnd buildfile(protect.bld) bootstrap(start) flat mod376 
2.4.6 The Protected Flat Example System 
Figure 2-7 shows what the memory looks like with the location of 


code, data, and system data structures after building the protected 
example system. 
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ffff ffffH 


reset 
vector--ffff fff@H 
ffff ffOGH 
ffff 9368H 
ffff @380H 
ffff 8240H 
ffff S280H 
ffff SlacH 


ffff O174H 


ffff 8169H 
ffff B2BBH 
fffe fQQ2H 


9881 BBGBH 
9808 ffffH 


8228 B488H 
9888 6381H 
8228 BBBBH 


limit of 
——— phantom code 
initialization code = - = 


init_code 


task state segment 
main_task 
| a | 


copytables 

Pde32 

global descr. table 
ees 


interrupt procedure 
intcode 


application code 
applic_code 
Se ae ees 


startup code 
syscode 


fe ee Pee eh 
interrupt descr. table 


expand-down_ stack 
appstack 


data and stack 
sysdata 


systeck 
applic_data 


reserved 


all segments' 
base 


expand-down stack 
lowest address 


limit of 
_Phantom_data_ 


(memory addresses wrap) 


Figure 2-7 Protected Example System Memory Map 


The maps portion of the builder listing file for the protect example 


system follows. 


2-34 


Exploring the Templates 


0 
oe 


88386 SYSTEM BUILDER 
12/14/88 13:33:82 PAGE 4 


SEGMENT MAP 
TABLE PBIT DPL ACCESS USE BASE LIMIT SEGMENT NAME 
GDT 
1 1 @ RW 16 FFFFO2@@H @@08003FH GODT: 
2 1 @ RW 16 FFFFG@@2H @GG0G19FH IDT: 
3 1 @ €£0 32 FFFFQ@08H SOBBFFOGH _ PHANTOM CODE_ 
4 1 ® RW 32 FFFF@@GGH BOB2GGGGH — PHANTOM DATA 
5 1 @ RWD 32 FFFFOQQ@GH FFFFEFFFH ASMSTART.APPSTACK 


LOT.1 (LDT1) 


RW 16 FFFFO119H @808004FH LODT1: 

EO 32 FFFF@16QH @@@22018H ASMSTART.SYSCODE 

RW 32 OBAG04GGH MGGGGGB6H ASMSTART.SYSDATA 
RWD 32 @8001408H FFFFEFFFH ASMSTART.SYSTACK 
FFFF@174H + @8800037H ASMSTART.APPLIC_ CODE 
RW 32 @08014G8H @BBBGGGG6H ASMSTART.APPLIC_DATA 
ER 32 FFFF@24QH @200G099H ASMSTART.CODE32 

ER 32 FFFF@368H @@G0Q0Q5EH ASMSTART.INIT CODE 
EO 32 FFFFG1ACH @@@00201H ASMSTART.INTCODE 


WONAMNSWNHH 
el 
QaHeeaagggagn 

m 

vn 

w 

Np 


88386 SYSTEM BUILDER 
12/14/88 13:33:02 PAGE 5 


GATE TABLE 
GATE NAME = TABLE PBIT DPL TYPE WC SELECTOR OFFSET 
INT_GATE IDT(33) 1 @ 386INTR 8 GDT(3) @BB8B1ACH 
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80386 SYSTEM BUILDER 
12/14/88 13:33:82 


TASK TABLE 


MAIN_TASK: TABLE = 
BASE = 
LIMIT = 
SSO: ESPB= 
SS1:ESP1= 
SS2:ESP2= 
SS:ESP = 


IOPRIV. = 
INTERRUPT 
DEBUG NOT 
INITIAL 


PROCESSING COMPLETED. 


2-36 


PAGE 6 


GDT(7) PBIT = 1 DPL=@ 


FFFFG30GH 
80000067H 
GDT (4) :820014@8H 


GDT (3 :86808168H 
GOT (4 

GH 

NOT ENABLED 
ENABLED 


2 WARNINGS, 


@ ERRORS 


~) 
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Appendix 


TEMPLATE FILE NAMES FOR V1.1 AND V2.8 
flatinit.asm flat.a38 
simpinit.asm flatsim.a38 


protinit.asm protflat.asm tree 
protflat.a38 (VMS 


flatintr.asm intrpt.a38 
protintr.asm intproc.asm 
cstart.asm cstart.a38 
asmstart.asm sys.asm 
bitcount.c bitcnt.c 
reverse.c revrs.c 
simple.c simple.c 
protect.asm applic.asm 
flat.bid flat.bid 
simple.bld simple.bld 


protect.bld applic.bld 
flat.bat ee flat.bat oe 


flat.com VMS)| flat.com VMS 


simple.bat et flatsim.bat ae) 
simple.com (VMS)| flatsim.com (VMS 


protect.bat ie prot.bat ne 
protect.com (VMS)| prot.com VMS 


showbitc.inc showbitc.inc 


Appendix-2 


TEMPLATE FILE NAMES FOR V1.1 AND V2.8 


(continued) . , 


V2.8 File name V1.1 File name(s) 6 


showrevr.inc 


showsimp.inc 


showprot.inc 


showrevr.inc 
simple.inc 


sys.ince and sysl.inc 


Glossary 


Italicized words and phrases in a definition refer to other glossary 


entries. 


16-bit real 
mode 


32-bit 
protected 
mode 


32-bit segment 


absolute 
addresses 


access 
attributes 


the mode of execution on the 386™ microprocessor 
where the processor executes instructions in their 
16-bit form. The protection-enable (PE) bit is off 
in the machine status word. Address calculation 
mimics the 8086 processor. The 386 microprocessor 
executes in this mode on reset. 


the mode of execution on the Intel386™ family 
microprocessors where the processor executes 
instructions in their 32-bit form. The protection- 
enable (PE) bit is on in the machine status word. 
The first far jump has been executed. This mode 
uses selectors and descriptors to calculate addresses. 
The 376™ microprocessor executes only in this 
mode. See also protection. 


a segment whose use-attribute is USE32. This 
attribute is the default for a segment. The 
use-attribute is represented by bit 54 (B/D) ina 
segment’s descriptor. By default, addresses and 
operands are 32 bits long. A 32-bit segment 
naturally corresponds to executing in 32-bit 
protected mode, but operand prefixes preceding 
some instructions allow the processor to execute a 
32-bit segment in 16-bit real mode. See also D bit. 


fixed locations in memory for data and code 
(contrary to relocatable addresses, which could 
change from execution to execution). See also 
bootloadable system, physical address, and 
relocating. 


characteristics which define the type of a segment: 
read-only data, read-write data, execute-read code, 
or execute-only code. These attributes are 
represented by bits 41 (W/R) and 43 (Executable) 
in a segment’s descriptor. 


ACCESS bit 


alias, 
alias descriptor 


base, 
base address 


binder, 
BND386 


bootloadable 
system 


bootstrap 
jump 


Glossary-2 


bit 24 in a segment’s descriptor that is set when the 
segment selector has been loaded into a segment 
register or used by selector test instructions. The 
ACCESS bit in the global descriptor table’s alias 
descriptor is set on execution of a load global 
descriptor table register (LGDT) instruction. 


a segment descriptor which has access attributes 
contrary to the normal use of the segment. The 
system builder always creates a global descriptor 
table with an alias descriptor for the global 
descriptor table itself in GDT[1] and an alias 
descriptor for the interrupt descriptor table in 
GDT[2]. These aliases have access attributes that 
describe the tables as writable data segments. 


the lowest offset of the item being discussed 
(except expand-down segments). Typical items are 
segments, tables, and task state segments. In a flat 
memory model, if the phantom segments have a 
base address of zero, all base addresses are the same 
as their physical addresses. See also relative base 
and expand-down. 


the RLL (DOS) or R&L (VMS) utility that 
performs linking. The binder combines segments 
with like names and resolves symbolic addressing. 
The binder can produce a loadable module 
(relocatable) or linkable module (suitable for input 
to the binder or the system builder). The binder 
cannot produce a bootloadable system. 


an object module with absolute addresses. A 
simple bootstrap loader can load a bootloadable 
system onto a target processor. The system contains 
code which initializes the processor on reset. See 
also system builder. 


the instruction located at the reset vector. Usually 
this instruction is a near jump to the initialization 
code. 


© 


= 


Italicized words and phrases in a definition refer to other glossary 


entries. 


builder, 
BLD386 


build file 


compatibility 
mode 


component 


D bit 


descriptor 


descriptor 
privilege level 
(DPL) 


See system builder. 


a file of system implementation definitions used by 
the system builder to create a bootloadable system. 
The definitions describe system data structures, 
initial values for the system, and memory 
configuration. 


See 16-bit real mode. 


microprocessor. 


bit 54 (B/D) in a segment’s descriptor. The D bit 
refers to the default operand size of a code 
segment. If the bit is 1, the default operand size is 
32 bits. If the bit is 0, the default operand size is 
16 bits. See also 32-bit segment. 


(1) eight bytes of memory containing the base, 
limit, and access attributes for a given region of 
linear address space such as a segment, table, or 
task state segment. Usually "descriptor" alone 
refers to the descriptor for a code or data segment. 
“Alias descriptor" most often refers to the descriptor 
for a table. “Task descriptor" or "TSS descriptor" 
refers to the descriptor for a task state segment. 

(2) a gate. 


bits 29 and 30 in a segment’s descriptor. The 
segmentation hardware checks descriptor privilege 
levels on accesses to code and data segments to 
ensure that the referring code has sufficient 
privilege. A flat model system has all segments at 
privilege level 0, which obviates the privilege-level 
checking. See also privilege levels, privileged 
instructions, and protection. 


Glossary-3 


direction flag 


entry point 


expand-down 


far jump 


fault handler 


gate 


Glossary-4 


bit 10 in the EFLAGS register. The value of this 
bit defines whether ESI and/or EDI registers 
postdecrement or postincrement during string 
instructions. 


the first instruction to be executed in a code 
segment or task. 


a special kind of data segment useful for stacks. 
Stack growth is down from the base address. The 
expand-down attribute is in bit 42 of the segment’s 
descriptor. A software system can dynamically 
increase the expand-down segment’s size by 
lowering the Jimit in the segment’s descriptor. A 
32-bit expand-down segment’s base address is one 
byte higher than its highest available address. Its 
lowest available address is the sum of its base plus 
limit plus one, ignoring any carry past 32 bits of 
address. Its size is the complement of its limit, or 
the difference of its base and lowest available 
address. Its minimum size is 4K bytes. 


an intersegment jump; this direct control-transfer 
instruction has a selector and offset representing 
the destination, which allows control to transfer to 
(possibly) a different code segment. 


code which executes when a fault, or interrupt, is 
raised. 


eight bytes of memory used to regulate transfer of 
control to another code segment. A gate is 
sometimes called a descriptor because it has a 
layout similar to a segment descriptor. It contains 
information about the selector for the target 
segment, the offset of the entry point within the 
target segment, the type and privilege level of the 
gate, and the number of words to pass on the stack. 
Gates provide indirection that allows the processor 
to perform protection checks. Gate types can be 
call, interrupt, trap, or task. 


ww) 


Italicized words and phrases in a definition refer to other glossary 


entries. 


general 
protection 
fault 


global 
descriptor 
table (GDT) 


global 
descriptor 
table register 
(GDTR) 


interrupt 


descriptor 
table (IDT) 


interrupt 
descriptor 
table register 
(IDTR) 


interrupt stubs 


limit 


linear 
addresses 


linker 


interrupt number 13 raised on a protection violation 
such as exceeding a segment /imit, violating the 
access attributes of a segment, or violating privilege 
levels. 


an array of descriptors defining segments and gates 
available for use by all tasks in the system. There 
is only one global descriptor table for a software 
system. 


the system register that contains the base and limit 
of the global descriptor table. 


an array of task, interrupt, and/or trap gates that 
act as interrupt vectors; each gate’s s/ot number is 
the interrupt number. There is only one interrupt 
descriptor table for a software system. 


the system register that contains the base and limit 
of the interrupt descriptor table. 


routines that execute when an interrupt occurs but 
do essentially nothing. 


the offset of the farthest available byte from the 
base address in a segment that is not expand-down. 
This value is one less than the number of bytes in 
the segment. For a 32-bit expand-down segment, 
the limit is the complement of the number of bytes 
in the segment. 


the same as physical addresses in a memory model 
which does not use any virtual memory. 


See binder. 


Glossary-5 


PTT a 


local 
descriptor 
table (LDT) 


local 
descriptor 
table register 
(LDTR) 


machine status 
word 


module 


near jump 


offset 


operand prefix 


overlaid 
segments 


Glossary-6 


an array of descriptors defining segments and gates 
protected from use by all but specified tasks in the 
system. Tasks that have a pointer to a local 
descriptor table in their task state segment can 
access that table. Sometimes the global descriptor 
table also holds descriptors for local descriptor 
tables. There can be many local descriptor tables 
in a software system. 


the system register that contains the selector for the 
descriptor of the currently active local descriptor 
table. 


bits 0 through 15 of control register 0 (CRO); 
contains the protection-enable (PE) bit. 


(1) a file of code in some stage of translation. An 
object module refers to the output of an assembler, 
compiler, binder, or system builder. An input 
module refers to a file in the form accepted by 
translating, linking, or building software. (2) a unit 
of code with some purpose, not necessarily an 
entire file, and possibly spanning several files. 


an intrasegment jump; a direct control-transfer 
instruction with an offset representing the 
destination, thus allowing control to transfer to 
code within the same code segment. 


the displacement; the number of units (usually 
bytes) away from the zeroth location in memory, or 
the number of units away from the base address of 
the enclosing segment or data structure. 


a byte of memory with value 66H preceding an 
instruction. The processor uses an operand size 
other than the default when executing this 
instruction. 


segments whose base and limit values cause them to 
share some or all of their physical addresses. 


Italicized words and phrases in a definition refer to other glossary 


entries. 


physical 
address 


prefetch queue 


privilege level 


privileged 
instructions 


protection 


protection- 
enable (PE) 
bit 


protection 
level 


real mode 


the offset of the first byte of an item from the 
zeroth byte in memory. The minimum physical 
address on the Intel386 microprocessors is zero; the 
maximum physical address is 4 gigabytes - 1, or 
ffffffffH. See also absolute addresses. 


the instruction pipeline on the Intel386 
microprocessors. 


one of four values: 0 (most privileged), 1, 2, or 3 
(least privileged). The descriptor privilege level 
(DPL) of the currently executing code segment is 
also called the current privilege level (CPL). See 
also selector. 


instructions that affect system registers or halt the 
processor. These instructions can only be executed 
when the current privilege level is 0. 


the mechanisms implemented by the hardware of 
the Intel386 microprocessors, especially when the 
protection-enable (PE) bit is on and the first far 
jump has been executed. There are five basic 
kinds of protection available: type checking, /imit 
checking, restriction of addressable domain, 
restriction of entry points, and restriction of 
instruction set. See also general protection fault, 
privileged instructions, and segmentation hardware. 


bit 0 in the machine status word. If PE is 1, the 
processor executes in 32-bit protected mode. If PE 
is 0, the processor operates in /6-bit real mode. 


See descriptor privilege level (DPL), and privilege 
level. 


See 16-bit real mode. 


Glossary-7 


map reepr te eens 


poe to eee 


relative base, 
relative offset 


relocating 


reset vector 


routine 


segment 


segmentation 
hardware 


selector 


slot 


Glossary-8 


the offset of the lowest address of the item being 
discussed from some other known address. An item 

such as a fable that is located within a larger 

segment has a base address relative to the base 

address of the larger segment. If the larger § 
segment has a physical base address of zero, the 

table’s base and relative base are the same physical 
address. 


the process of changing the physical address of an 
item, and adjusting all references to that item. 


physical address fffffff0H on the Intel386 famly 
processors. The processor executes the instruction 
at this location first on reset. See also bootstrap 
jump. 


a piece of executable code with a well-defined 

entry point and exit point. A routine is similar to a 
subroutine but may be jumped to or executed on a 

trap or interrupt rather than called. 6 


a continuous piece of memory defined by a base 
address and a limit. See also descriptor, 32-bit 
Segment, expand-down, and overlaid segments. 


the parts of the Intel386 family microprocessors 
that implement protection for accessing segments. 
See also general protection fault. 


a system data structure used in computing an 

address that identifies a descriptor by specifying a 
descriptor table and indexing a descriptor within 

that table. A selector also contains a requested 

privilege level (RPL), which is the descriptor 

privilege level (DPL) of the referring segment. 

Currently available segments are represented by 

selectors in the segment registers CS, DS, SS, ES, © 
FS, and GS. 


a particular 8-byte position in a descriptor table. 


Italicized words and phrases in a definition refer to other glossary 


entries. 
system 
builder, 
BLD386 


system data 
structures 


table 


task 


task state 
segment (TSS) 


the RLL (DOS) or R&L (VMS) utility that creates a 
bootloadable system from linkable input modules 
and system definitions in a build file. 


regions of continuous linear address space with 
values in defined positions. Descriptors, tables, 
gates, selectors, and task state segments are the 
most common system data structures. Sometimes 
discussion of system data structures includes the 


system registers. 


an array of descriptors and/or gates. Each active 
table has a system register that points to the table. 
See also global descriptor table, interrupt descriptor 


table, and local descriptor table. 


(1) the code, data, and system data structures 
which collectively define a sequential thread of 
execution. (2) one or more of the system data 


structures associated with a task: 


task state 


segments, task or TSS descriptor, or task gate. 


a system data structure of a minimum of 68H byl 
that at least describes the processor state (such as 
contents of registers) upon entry to or exit from a 
task. Other literature refers to this type of data 


structure as a task control block. 
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Index 


-> prompt, 1-4, 1-5 
16-bit real mode, 1-5, 2-3, G-1, G-3, G-7 
32-bit protected mode, 1-1, 2-1, 2-3, 2-4, 
2-15, 2-22, G-1, G-7 
32-bit segment, G-1, G-3, G-8 
376” microprocessor, 2-4, 2-9, 2-16, G-1 
386” microprocessor, 2-3, 2-9, 2-16, G-1 
_phantom_code_, 2-2, 2-8, 2-16, 2-17, 
2-34 
Base address, 2-2, 2-3, 2-20, 2-21, 
2-27 
Descriptor, 2-3 
DPL, 2-2, 2-8, 2-27 
Limit, 2-2, 2-20, 2-21, 2-27 
_phantom_data_, 2-2, 2-8, 2-16, 2-17, 
2-21, 2-34 
Base address, 2-2, 2-3, 2-20, 2-21, 
2-27 
Descriptor, 2-3, 
see also_phantom_code_, 
_phantom_data_, Alias 
descriptor, Gate, Global 
descriptor table, Interrupt 
descriptor table 
DPL, 2-2, 2-8, 2-27 
Limit, 2-2, 2-20, 2-21, 2-27 


A 


Absolute address, G-1, G-2, G-7 
Access attributes, G-1, G-2, G-3, G-5 
ACCESS bit, 2-4, G-2 
Alias descriptor, 2-4, 2-23, G-2, G-3 
Application code 
applic_code segment, 2-22, 2-34 
applic_data, 2-22 
applic_func, 2-22 
appstack segment, 2-22 
bitcount.c or reverse.c, 2-3 
code32 segment, 2-3 
data segment, 2-3 


stack segment, 2-3 
main, 2-3 
protect.asm, 2-22, 2-31 


ASM386 assembler, 1-3, 2-3, 2-15, 2-33 
debug control, 2-15, 2-33 
Listing files, 2-15 
Object files, 2-15, 2-33 
Warning messages, 1-4, 2-15 


B 


Base address, G-2, G-3, G-4, G-5, G-6, 
G-8 
BASE specification, 2-9 
Binder, 1-3, G-2, G-6 
Combining segments, 2-3, 2-15, 2-33 
debug control, 2-15, 2-33 
Listing files, 2-15 
noload control, 2-15, 2-33 
object control, 2-15, 2-33 
Object files, 2-15, 2-33 
Resolving symbolic addressing, 2-15, 
2-33 
BLD386, 1-1, 1-2, 1-3, 2-1, 2-9, 2-10, 
2-16, 2-33, G-3 
see also Build file, System builder 
BND386, 1-3, 2-15, 2-33 
see also Binder 
Bootloadable system, 1-1, 2-3, 2-9, 2-10, 
2-15, 2-22, G-2, G-3, G-9 
bootstrap control, 2-16, 2-33 
Bootstrap jump, 2-16, G-2, G-8 
see also Reset vector 
Build file, 2-1, G-3, G-9 
flat.bld, 1-2, 2-8, 2-9, 2-10, 2-16 
GATE definition, 2-9 
ENTRY specification, 2-9 


Build file (continued) 

MEMORY definition, 2-9 
RANGE specification, 2-10 
RESERVE specification, 2-10 

protect.bld, 1-3, 2-27, 2-33 

RAM, 2-2 

ROM, 2-2 

SEGMENT definition, 2-8, 2-20, 

9-71, 0-97 
simple.bld, 1-2 
TABLE definition, 2-8, 2-10, 2-21, 
2-27 
LOCATION specification, 2-9 
TASK definition, 2-9 
Builder, see BLD386, Build file, System 
builder 
buildfile control, 2-16, 2-33 


Cc 


C-386, 1-2, 1-3, 2-3, 2-15 
code control, 2-15 
debug control, 2-15 
Listing files, 2-15 
Object files, 2-15 
regallocate control, 2-15 

c startup, 2-4 

code control, 2-15 

Compatibility mode, see 16-bit real 

mode 

Component, G-3 

copytables, 2-4, 2-22, 2-34 


D 


D bit, G-1, G-3 

debug control, 2-15, 2-33 

Descriptor, 1-1, G-1, G-2, G-3, G-4, G-5, 
G-6, G-8, G-9 

Descriptor privilege level (DPL), 2-2, 
2-8, 2-27, G-3, G-7, G-8 


Index-2 


Descriptor tables, see Global descriptor 


table (GDT), Interrupt descriptor 


table (IDT), Local descriptor 
table (LDT), Tables 
Development system, 1-3 
Direction flag, G-4 
Directions, 1-3, 1-4, 1-5 


E 


Embedded example, 2-1, 2-3, 2-4, 2-22, 
2-33 
bitcount, 2-17 
bitcount.c, 1-2 
Build file template, 2-8 
C startup template, 2-14 
Creating, 1-4, 2-15, 2-16 
cstart.asm, 1-2, 2-14 
Emulating, 1-4, 1-5 
Executing, 1-5 
flat.bat, 1-2, 2-15, 2-16 
flat-bld, 1-2, 2-8 
flat.com, 1-2, 2-15, 2-16 
flatinit.asm, 1-2, 2-3, 2-4 
flatintr.asm, 1-2, 2-12 
Initialization template, 2-3, 2-4 
Interrupt stubs template, 2-12 
Memory map, 2-17 
reverse.c, 1-2 
showbitc.inc, 1-2 
showrevr.inc, 1-2 
Structure of source files, 2-3 
Emulator commands, 2-9 
Error #-26t, 1-5 
Including, 1-5 
istep, 1-5 
showbitc.inc, 1-2 
showprot.inc, 1-3 
showrevr.inc, 1-2 
showsimp.inc, 1-2 
Entry point, G-4, G-7, G-8 
ENTRY specification, 2-9 
Error #-26t, 1-5 


§ 


Expand-down, G-2, G-4, G-5, G-8 
appstack segment, 2-34 
Base address, 2-21, G-2, G-4 
(ED), 2-21 
Installing descriptor, 2-21, 2-27 
Limit, 2-21, G-4, G-5 
Stack, 2-1, 2-21, 2-27 


F 


Far jump, G-1, G-4, G-7 
Fault handler, G-4 
flat control, 2-1, 2-2, 2-3, 2-8, 2-16, 2-33 
Flat model, 1-1, 2-1, 2-3, 2-9, 2-16, 2-20, 
2-21 
default, 2-2, 2-3 


G 


Gate, 1-1, 2-2, G-3, G-4, G-5, G-6, G-9 
Descriptors, 2-9, G-4 
Interrupt, 2-9 
Task, 2-9 
Trap, 2-9 
GATE definition, 2-9 
ENTRY specification, 2-9 
gdt_desc, 2-9, 2-22 
General protection fault, 2-20, G-5, G-7, 
G-8 
Global descriptor table (GDT), 2-8, 
2-17, 2-21, 2-34, G-2, G-5, G-6, 
G-9 
see also Tables 
ACCESS bit in alias descriptor, 2-4 
Alias descriptor, 2-4, 2-23 
Base address, 2-4, 2-9 
Copying from ROM to RAM, 2-4 
Defining, 2-8, 2-9, 2-27 
Installing expand-down stack 
descriptor, 2-27 
Limit, 2-4, 2-9 
Relative base address, 2-23 


Global descriptor table register 
(GDTR), G-5 


H-I 


Hardware (required), 1-3 
ICE™ -376 in-circuit emulator, 2-15 
ICE™ -386 in-circuit emulator, 1-2, 1-3, 
2-15 
-> prompt, 1-4 
DOS directory, 1-4 
Executing, 1-5 
Invocation, 1-4 
Real mode, 1-5 
idt_desc, 2-9, 2-22 
Initialization code, G-2 
code32 segment, 2-3, 2-4, 2-17, 2-22, 
2-34 
copytables, 2-4, 2-22, 2-34 
flatinit.asm, 1-2, 2-3, 2-4 
flatstart, 2-3 
gdt_desc, 2-9, 2-22 
idt_desc, 2-9, 2-22 
init_code segment, 2-3, 2-4, 2-9, 2-17, 
2-22, 2-34 
protinit.asm, 1-3, 2-22, 2-23 
protstart, 2-22 
simpinit.asm, 1-2 
Intel386™ architecture, 1-1 
Instructions 
32-bit, 2-4 
Privileged, 2-15 
Interrupt code 
Dummy interrupt procedure, 2-29 
flatintr.asm, 1-2, 2-3, 2-12 
int_proc, 2-22 
interrupts, 2-3 
intproc segment, 2-22 
intrupt_routines segment, 2-3 
protintr.asm, 1-3, 2-22, 2-29 
Public labels of handlers, 2-9 
Stub routines, 2-3, 2-12, G-5 


Index-3 


aD: 


Interrupt descriptor table (IDT), 2-17, 
2-34, G-2, G-5, G-9 
see also Tables 
Alias descriptor, 2-4, 2-23 
Base address, 2-4, 2-9 
Copying from ROM to RAM, 2-4 
Defining, 2-9, 2-27 
Gate descriptors, 2-9 
Installing interrupt gate, 2-27 
Limit, 2-4, 2-9 
Relative base address, 2-23 
Interrupt descriptor table register 
(IDTR), G-5 
Interrupt stubs, G-5 
Interrupts 
Defined, 2-12 
Generating, 2-30 
Reserved, 2-12, 2-29 
istep command, 1-5 


L 


Igdt instruction, 2-4, G-2 
Igdtw instruction, 2-4 
Limit, G-3, G-4, G-5, G-6, G-7, G-8 
Linear address, G-5, G-9 
Linked input segments, 2-1 
Linker, see binder 
Listing files 
bitcount.Ist, 2-15 
bitcount.mp1, 2-15 
bitcount.mp2, 2-16, 2-17 
cstart.Ist, 2-15 
flatinit.Ist, 2-15 
flatintr.Ist, 2-15 
protect.mp2, 2-34 
reverse.|st, 2-15 
reverse.mpl, 2-15 
reverse.mp2, 2-16 
Local descriptor table (LDT), 2-10, G-6, 
G-9 
see also Tables 
Contents in builder listing, 2-10 


Index-4 


Creating, 2-10 
Eliminating from bootloadable 
system, 2-10 


LDT1, 2-10 
Local descriptor table register (LDTR), ) 
G-6 
LOCATION specification, 2-9 


M 


Machine status word, G-1, G-6, G-7 
Map files 
bitcount.mp1, 2-15 
bitcount.mp2, 2-16, 2-17 
protect.mp2, 2-34 
reverse.mpl1, 2-15 
reverse.mp2, 2-16 
Memory addresses wrapping, 2-21, 2-23 
Memory configuration, 2-1, 2-10, 2-17, 
2-33, 2-34, G-3 
RAM, 2-4 ¢ 
ROM, 2-4 re 
MEMORY definition, 2-9 
RANGE specification, 2-10 
RESERVE specification, 2-10 
Memory maps 
Default flat memory model, 2-2 
Embedded example, 2-17 
Minimally protected flat model, 2-20 
Protected example, 2-34 
Protected flat model with 
expand-down stack, 2-21 
mod376 control, 2-16, 2-33 
Module, G-2, G-6, G-9 


N-O 


Near jump, G-2, G-6 0) 
noload control, 2-15, 2-33 ° 
object control, 2-15, 2-33 
Object modules 

asmstart.obj, 2-33 

bitcount.bnd, 2-15, 2-16 


ve) 


Object modules (continued) 
bitcount.obj, 2-15 
cstart.obj, 2-15 
flatinit.obj, 2-15 
flatintr.obj, 2-15 
intrpt.obj, 2-16 
protect.bnd, 2-33 
protect.obj, 2-33 
protinit.obj, 2-33 
protintr.obj, 2-33 
reverse.bnd, 2-15, 2-16 
reverse.obj, 2-15 

Offset, G-2, G-4, G-5, G-6, G-7, G-8 

Operand prefix, 2-4, G-1, G-6 

Overlaid segments, G-6, G-8 


P 


PE bit, see Protection-enable (PE) bit 
Physical address, G-2, G-5, G-6, G-7, 
G-8 
Prefetch queue, G-7 
Privilege level, G-3, G-4, G-5, G-7, G-8 
see also Descriptor privilege level 
(DPL) 
Privileged instructions, G-3, G-7 
Program Development Templates disk 
(DOS), 1-4 
Protected example, 2-1, 2-22 
Application template, 2-31 
ASM386 startup template, 2-30 
asmstart.asm, 1-3, 2-30 
Build file template, 2-27 
Creating, 1-4, 2-33 
Differences from embedded 
example, 2-22 
Dummy interrupt, 2-22 
Dummy interrupt template, 2-29 
Emulating, 1-4, 1-5 
Executing, 1-5 
Expand-down stack, 2-22 


Initialization template, 2-22, 2-23 
Dependency on phantom 
segments’ base, 2-23 
Memory map, 2-33, 2-34 
protect, 2-34 
protect.asm, 1-3, 2-31 
protect.bat, 1-3, 2-33 
protect.bld, 1-3, 2-27, 2-33 
protect.com, 1-3, 2-33 
protinit.asm, 1-3, 2-22, 2-23 
protintr.asm, 1-3, 2-29 
showprot.inc, 1-3 
Structure of source files, 2-22 
Protected flat model, 2-20, 2-21, 2-27 
Minimum definition, 2-20 
Protected flat model with expand-down 
stack, 2-21 
Protected mode (32-bit), 1-1, 2-1, 2-3, 
2-4, 2-15, 2-22 
Protection, G-3, G-4, G-5, G-7, G-8 
Protection levels, 2-1, G-7 
see also Descriptor privilege level 
(DPL) 
Protection-enable (PE) bit, G-1, G-6, 
G-7 


R 


RANGE specification, 2-10 

Real mode (16-bit), 1-5, 2-3 

regallocate control, 2-15 

Relative base, G-2, G-8 

Relocating, G-2, G-8 

RESERVE specification, 2-10 

Reset vector, 2-17, 2-34, G-2, G-8 

see also Bootstrap jump 

RLL, 1-3 

ROM-based systems, 2-4 
Returning a READY on a write, 2-4 

Routine, G-5, G-8 
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Segment, 1-1, G-2, G-3, G-4, G-5, G-6, 


G-7, G-8 
32-bit, 2-4, G-1, G-3, G-8 
Access attributes, 2-2, 2-10, G-1, G-2, 
G-3, G-5 
Executable . 2, 2-10, G-1 
Linking input, 2-1 
Overlaid, 2-2, 2-8, G-6, G-8 
Read-only, 2-2, 2-10, G-1 
Read-write, 2-2, 2-10, G-1 
Writable, G-2 


SEGMENT definition, 2-8, 2-20, 2-21, 


2-27 


Segmentation hardware, 2-20, G-3, G-7, 


G-8 


Selectors, 1-5, G-1, G-2, G-4, G-6, G-7, 


G-8, G-9 


Simple example 


Creating, 1-4 
cstart.asm, 1-2 
Emulating, 1-4, 1-5 
Executing, 1-5 
showsimp.inc, 1-2 
simpinit.asm, 1-2 
simple.bat, 1-2 


flat.bld, 1-2, 2-10 
flat.com, 1-2 
flatinit.asm, 1-2, 2-4 
flatintr.asm, 1-2, 2-12 
protect.asm, 1-3, 2-31 
protect.bld, 1-3, 2-27 
protinit.asm, 1-3, 2-23 
protintr.asm, 1-3, 2-29 
reverse.c, 1-2 
simpinit.asm, 1-2 
simple.bld, 1-2 
simple.c, 1-2 
Stack, 2-2, 2-10, 2-17, 2-20, 2-21 
Defining, 2-14, 2-30 
Overflow protection, 2-21 
Separate expand-down, 2-21 
Stack pointer 
Initializing, 2-14, 2-30 
start, 2-16, 2-33 
Startup code, 2-4 
asmstart, 2-22 
asmstart.asm, 1-3, 2-22, 2-30 
c_startup, 2-4 
code32 segment, 2-3 
cstart, 2-3 
cstart.asm, 1-2, 2-3, 2-14 
data segment, 2-3 
stack segment, 2-3 


LY 


simple.bld, 1-2 syscode segment, 2-22, 2-34 
simple.c, 1-2 sysdata segment, 2-22 
simple.com, 1-2 systack segment, 2-22 

Slot, G-5, G-8 SYS&ROOT:[SYSHLP.EASE] 

Software (required), 1-3 directory (VMS), 1-4 

Source code System builder, 1-1, 1-3, 2-1, 2-2, 2-4, 


asmstart.asm, 1-3, 2-30 

bitcount.c, 1-2 

bitcount.c or reverse.c, 2-3 

cstart.asm, 1-2, 2-14 

File structure for embedded 
example, 2-3 

File structure for protected example, 
2-22 

flat.bat, 1-2 
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2-10, 2-21, 2-22, G-2, G-3, G-6, 
G-9 
see also Build file 
Allocating space, 2-2 
bootstrap control, 2-16, 2-33 
buildfile control, 2-16, 2-33 
Combining segments, 2-2 
Final system files, 2-16 
flat control, 2-1, 2-2, 2-8, 2-16, 2-33 


O 


System builder (continued) 
Listing files, 2-16, 2-17, 2-34 
mod376 control, 2-16, 2-33 
Warning messages, 1-4, 2-16 
System data structures, 1-1, 2-1, 2-9, 
2-17, 2-33. 2-34, G-3, G-8, G-9 
see also auias descriptors, 
Descriptor, Gate, Tables, Task 
state segments, Selectors 
System reset, 2-1 
Systems (example) 
bitcount, 1-2, 1-4, 1-5, 2-16 
Creating, 1-4 
Different kinds, 1-1 
Embedded, 1-1 
Emulating, 1-4, 1-5 
Executing, 1-5 
protect, 1-3, 1-4, 1-5, 2-33 
Protected, 1-1 
RAM, 1-1 
c*) reverse, 1-2, 1-4, 1-5, 2-16 
; ROM, 1-1 
Simple, 1-1, 1-2, 1-4, 1-5 
Type of example, 1-2 


T 

TABLE definition, 2-8, 2-9, 2-10, 2-21, 
2-27 

Tables, 2-2, 2-4, 2-10, G-2, G-3, G-8, 
G-9 


see also Global descriptor table 


(GDT), Interrupt descriptor table 


(IDT), Local descriptor table 
(LDT) 
Address calculation, 2-4, 2-22 
Copying from ROM to RAM, 2-4, 
Qo pie) 
Location in memory, 2-4, 2-9 
Relocating without re-assembling, 
2-9 
Task, 2-9, G-4, G-5, G-6, G-9 
TASK definition, 2-9 


Task state segment (TSS), 2-2, 2-10, 
G-2, G-3, G-6, G-9 
DOS location, 1-4 
main_task, 2-17, 2-34 
Source code, 1-2, 1-3 
VMS location, 1-4 
Templates, 1-1, 2-1, 2-15 


U 


USE32 use-attribute, G-1 
see also D bit, descriptor 


Ww 


Warning messages, 1-4, 2-15, 2-16 
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versions. 


To order publications, contact the Intel Literature Department (see page ii of this manual). 


Fill in the squares below with a rating of | through 10: 


POOR AVERAGE EXCELLENT 


1 2 3 5 9 10 
Readability 
Technical depth 
Technical accuracy 
Usefulness of material for your needs 
Comprehensibility of material 
OVERALL QUALITY OF THIS MANUAL 


If you gave a 4 or less (in any category), please explain here: 


What suggestions would you have for improving this manual: 


If you would like us to call you for more specific suggestions about this book, please additionally fill in 
your phone number below. 

Name 

Phone Number (________). 


Address 


Thanks for taking the time to fill out this form. 
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INTEL CORPORATION 

DTO TECHNICAL PUBLICATIONS HF2-38 
5200 NE ELAM YOUNG PARKWAY 
HILLSBORO OR 97124-9978 


Please fold here and close the card with tape. Do not staple. 


WE’D LIKE YOUR COMMENTS. ... 


This document is one of a series describing Intel products. Your 
comments on the other side of this form will help us produce better 
manuals. Each reply will be reviewed. All comments and suggestions 
become the property of Intel Corporation. 


If you are in the United States and are sending only this card, postage is 
prepaid. 


States, please insert this card and any enclosures in an envelope. Send 
the envelope to the above address, adding “United States of America’ if 
you are outside the United States. 


If you are sending additional material or if you are outside the United 0) 


Thanks for your comments. 
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